One account for every Strong product
Strong ID is the sign-in for Disk, Mail, POS, Stay and the other products. Protect your account once with a passkey or a second factor, and that protection works everywhere. You see which apps have access and revoke it yourself.
Beta: id.strong.ee is live. Strong Disk connects first, followed by the other Strong products.
- 5 min
- access token lifetime; sign-in code — 60 seconds
- Passkeys
- passwordless sign-in — Touch ID, Face ID, Windows Hello
- OAuth 2.1
- and OpenID Connect: PKCE S256, mandatory state and nonce
- 3 languages
- interface and emails in Estonian, Russian and English
Sign-in you don't have to set up in every product
Strong products connect to Strong ID via the open OpenID Connect standard and verify sign-in themselves — Strong ID doesn't slow them down.
One sign-in everywhere
Sign in once and open Disk, Mail and other products without another password. Each product gets its own opaque user identifier.
Passkeys
Passkeys instead of a password: sign in with your fingerprint, face or device PIN. Passkeys are added and removed in your account.
Two-factor sign-in
Authenticator app (TOTP) with a QR code, 10 one-time backup codes, “trust this device” for 30 days.
Organizations
Your company as an organization: email invitations, owner, admin and member roles. Only the addressee with a verified email can accept an invitation.
Email and recovery
Email verification, password reset via a one-time link valid for an hour, sign-out on all devices after a password change.
Explicit consent
The product shows what it wants to receive: profile, email, staying signed in. You grant the permission.
Account deletion
Deletion with your password and email confirmation: sessions, 2FA, passkeys, memberships, consents and tokens are deleted along with the account.
Apps with access
A list of products you've given access to, with one-click revocation. Once revoked, a product gets no new tokens.
The product asks for permission — you decide
On your first sign-in to a product, Strong ID shows who is requesting which data. After that, sign-in happens without extra steps.
- Authorization code with PKCE S256 only — no outdated or insecure flows
- state and nonce are mandatory; redirect URIs must match exactly
- Products only receive a verified email
- Different products can't link a user by identifier (pairwise sub)
- Only a platform administrator can register products
Security and data in your hands
Everything about your account on one page: profile, email, second factor, passkeys, apps and deletion.
- Change your name and verify your email
- Turn on 2FA and save backup codes
- Add a passkey on every device
- Revoke any product's access
- Delete your account with all its data — your right under GDPR
Stricter than the standard requires
The OAuth 2.1 / OpenID Connect profile is tightened wherever the standard allows leeway. Every rule is checked by an automated test.
- Passwords are stored with argon2id; secrets and one-time codes only as hashes
- Sign-in codes live 60 seconds, access and ID tokens 5 minutes
- Refresh tokens rotate; reuse revokes the whole chain
- EdDSA signatures, public keys published in JWKS — products verify tokens themselves
- Rate limits by the client's real IP; the service won't start without required settings
- A separate PostgreSQL database and its own secrets; can be deployed on your own server
Frequently asked questions
Why a separate account if the product can already sign in with a password?
So that sign-in and its protection are the same for all products: a passkey and second factor are set up once, not in each product separately.
Will my existing Disk or Mail users be lost?
No. Accounts aren't merged automatically by email — users link Strong ID themselves by confirming sign-in to the product with their password.
Can I connect sign-in via Microsoft Entra ID or Google Workspace?
Not yet. Enterprise sign-in through an external provider for organizations is the next stage.
Can I host Strong ID myself?
Yes. Strong ID is an API and interface with its own PostgreSQL, deployed in Docker alongside Strong products.
Which products already use Strong ID?
Strong ID is live at id.strong.ee. Strong Disk connects first, followed by Mail and the other products. You can create an account today.
One sign-in for your team
Tell us which products your team uses — we'll show sign-in, organizations and roles in a demo.